# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [IBM Security Verify Governance information disclosure](https://agentprime.io/advisories/CVE-2022-22466.md)
  `CVE-2022-22466` · CVE record: IBM Security Verify Governance · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: Hard-coded credentials
- [Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables](https://agentprime.io/advisories/GHSA-2rcp-jvr4-r259.md)
  `GHSA-2rcp-jvr4-r259`, `CVE-2023-46115` · crates.io `tauri-cli` and 1 more: affected `>=1.0.0, <1.5.6 || >=2.0.0-alpha.0, <2.0.0-alpha.16`, fixed in `1.5.6`, `2.0.0-alpha.16` · CVSS 8.4 High · Not analysed yet · Published 20 Oct 2023 · Tags: Information disclosure, Hard-coded credentials
- [Hard-coded password in SonicWall SonicOS](https://agentprime.io/advisories/CVE-2023-41713.md)
  `CVE-2023-41713` · CVE record: SonicWall SonicOS · No CVSS score · Not analysed yet · Published 17 Oct 2023 · Tags: Hard-coded credentials
- [IBM Security Verify Governance information disclosure](https://agentprime.io/advisories/CVE-2023-33836.md)
  `CVE-2023-33836` · CVE record: IBM Security Verify Governance · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Hard-coded credentials
- [BIG-IP Next SPK SSH vulnerability](https://agentprime.io/advisories/CVE-2023-45226.md)
  `CVE-2023-45226` · CVE record: F5 BIG-IP Next SPK · CVSS 7.4 High · Not analysed yet · Published 10 Oct 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Siemens CP-8031 MASTER MODULE and others](https://agentprime.io/advisories/CVE-2023-36380.md)
  `CVE-2023-36380` · CVE record: Siemens CP-8031 MASTER MODULE and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2023 · Tags: Hard-coded credentials
- [QVPN Device Client](https://agentprime.io/advisories/CVE-2023-23370.md)
  `CVE-2023-23370` · CVE record: QNAP Systems Inc. QVPN Windows · CVSS 6.7 Medium · Not analysed yet · Published 6 Oct 2023 · Tags: Hard-coded credentials
- [Qognify NiceVision Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-2306.md)
  `CVE-2023-2306` · CVE record: Qognify NiceVision · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Cisco Emergency Responder](https://agentprime.io/advisories/CVE-2023-20101.md)
  `CVE-2023-20101` · CVE record: Cisco Cisco Emergency Responder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2023 · Tags: Hard-coded credentials
- [Admin password reset in NetMan 204](https://agentprime.io/advisories/CVE-2022-47891.md)
  `CVE-2022-47891` · CVE record: Riello UPS Netman-204 · CVSS 8.1 High · Not analysed yet · Published 3 Oct 2023 · Tags: Hard-coded credentials
- [Microweber uses hard coded credentials](https://agentprime.io/advisories/GHSA-r657-3wqh-g2x9.md)
  `GHSA-r657-3wqh-g2x9`, `CVE-2023-5318`, `PKSA-m9c6-mgh7-jfgc` · Packagist `microweber/microweber`: affected `<=1.3.4`, no fixed version yet · CVSS 5.8 Medium · Not analysed yet · Published 30 Sept 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Cisco SD-WAN vManage](https://agentprime.io/advisories/CVE-2023-20034.md)
  `CVE-2023-20034` · CVE record: Cisco Cisco SD-WAN vManage · CVSS 7.5 High · Not analysed yet · Published 27 Sept 2023 · Tags: Hard-coded credentials
- [Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password](https://agentprime.io/advisories/CVE-2023-5222.md)
  `CVE-2023-5222` · CVE record: Viessmann Vitogate 300 · CVSS 6.3 Medium · EPSS 0.80 · Not analysed yet · Published 27 Sept 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Acronis Cyber Protect 15](https://agentprime.io/advisories/CVE-2023-44158.md)
  `CVE-2023-44158` · CVE record: Acronis Acronis Cyber Protect 15 · CVSS 3.5 Low · Not analysed yet · Published 27 Sept 2023 · Tags: Hard-coded credentials
- [Weak password of selenium VNC in MeterSphere](https://agentprime.io/advisories/CVE-2023-41878.md)
  `CVE-2023-41878` · CVE record: metersphere metersphere · CVSS 4.6 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: Hard-coded credentials
- [OpenStack Barbican credential leak flaw](https://agentprime.io/advisories/GHSA-6qqp-4vm3-359v.md)
  `GHSA-6qqp-4vm3-359v`, `CVE-2023-1633`, `PYSEC-2026-1213` · PyPI `barbican`: affected `<=16.0.0`, no fixed version yet · CVSS 6.6 Medium · Not analysed yet · Published 24 Sept 2023 · Tags: Information disclosure, Hard-coded credentials
- [Duplicate Advisory: EVE Has Partially Predetermined Vault Key](https://agentprime.io/advisories/GHSA-hx74-4wmc-fwvf.md)
  `GHSA-hx74-4wmc-fwvf` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20220310190112-c0c966dc31e2`, fixed in `0.0.0-20220310190112-c0c966dc31e2` · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 21 Sept 2023 · Tags: Hard-coded credentials
- [Duplicate Advisory: EVE: SSH as Root Unlockable Without Triggering Measured Boot](https://agentprime.io/advisories/GHSA-f6wp-8j9r-frrg.md)
  `GHSA-f6wp-8j9r-frrg` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20220708121648-5fef4d92e758`, fixed in `0.0.0-20220708121648-5fef4d92e758` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 21 Sept 2023 · Tags: Hard-coded credentials
- [Duplicate Advisory: EVE's Debug Functions Unlockable Without Triggering Measured Boot](https://agentprime.io/advisories/GHSA-6958-8cpr-xgrq.md)
  `GHSA-6958-8cpr-xgrq` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20220708121648-5fef4d92e758`, fixed in `0.0.0-20220708121648-5fef4d92e758` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 21 Sept 2023 · Tags: Hard-coded credentials
- [Duplicate Advisory: EVE Doesn't Protect Config Partition with Measured Boot](https://agentprime.io/advisories/GHSA-3wmx-9qwp-h363.md)
  `GHSA-3wmx-9qwp-h363` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20230519072751-977f42b07fa9`, fixed in `0.0.0-20230519072751-977f42b07fa9` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 21 Sept 2023 · Tags: Hard-coded credentials
- [Authentication Bypass in D-Link D-View 8](https://agentprime.io/advisories/CVE-2023-5074.md)
  `CVE-2023-5074` · CVE record: D-Link D-View 8 · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.69 · Not analysed yet · Published 20 Sept 2023 · Tags: Hard-coded credentials
- [Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 Fronts](https://agentprime.io/advisories/GHSA-5jvg-8j6f-vpmc.md)
  `GHSA-5jvg-8j6f-vpmc` · Go `github.com/lf-edge/eve`: affected `<0.0.0-20230126065759-d9383a7ee4e1`, fixed in `0.0.0-20230126065759-d9383a7ee4e1` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 20 Sept 2023 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Insufficiently protected credentials in NVIDIA DGX H100 BMC](https://agentprime.io/advisories/CVE-2023-25532.md)
  `CVE-2023-25532` · CVE record: NVIDIA DGX H100 BMC · CVSS 6.5 Medium · Not analysed yet · Published 20 Sept 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in NVIDIA DGX H100 BMC](https://agentprime.io/advisories/CVE-2023-25531.md)
  `CVE-2023-25531` · CVE record: NVIDIA DGX H100 BMC · CVSS 7.6 High · Not analysed yet · Published 20 Sept 2023 · Tags: Hard-coded credentials
- [Juplink RX4-1500 Hard-coded Credential Vulnerability](https://agentprime.io/advisories/CVE-2023-41030.md)
  `CVE-2023-41030` · CVE record: Juplink RX4-1500 · CVSS 6.3 Medium · Not analysed yet · Published 18 Sept 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Fortinet FortiTester](https://agentprime.io/advisories/CVE-2023-40717.md)
  `CVE-2023-40717` · CVE record: Fortinet FortiTester · CVSS 5.0 Medium · Not analysed yet · Published 13 Sept 2023 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in multiple /irmdata/api/ endpoints](https://agentprime.io/advisories/CVE-2023-39422.md)
  `CVE-2023-39422` · CVE record: Resort Data Processing, Inc. IRM Next Generation · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2023 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in RDPWin.dll](https://agentprime.io/advisories/CVE-2023-39421.md)
  `CVE-2023-39421` · CVE record: Resort Data Processing, Inc. IRM Next Generation · CVSS 7.7 High · Not analysed yet · Published 7 Sept 2023 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in RDPCore.dll](https://agentprime.io/advisories/CVE-2023-39420.md)
  `CVE-2023-39420` · CVE record: Resort Data Processing, Inc. IRM Next Generation · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in TP-LINK Archer C50 and others](https://agentprime.io/advisories/CVE-2023-32619.md)
  `CVE-2023-32619` · CVE record: TP-LINK Archer C50 and 1 more · CVSS 8.8 High · Not analysed yet · Published 6 Sept 2023 · Tags: Hard-coded credentials
- [MXsecurity Hardcoded Credential](https://agentprime.io/advisories/CVE-2023-39982.md)
  `CVE-2023-39982` · CVE record: Moxa MXsecurity Series · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2023 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-31173.md)
  `CVE-2023-31173` · CVE record: Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator · CVSS 7.7 High · Not analysed yet · Published 31 Aug 2023 · Tags: Hard-coded credentials
- [ProfileGrid <= 5.5.0 - Hardcoded Encryption Key](https://agentprime.io/advisories/CVE-2023-3404.md)
  `CVE-2023-3404` · CVE record: metagauss ProfileGrid – User Profiles, Groups and Communities · CVSS 4.9 Medium · Not analysed yet · Published 31 Aug 2023 · Tags: Hard-coded credentials
- [Pass-back vulnerability in Nessus](https://agentprime.io/advisories/CVE-2023-3251.md)
  `CVE-2023-3251` · CVE record: Tenable Nessus · CVSS 4.1 Medium · Not analysed yet · Published 29 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded password in Motorola MBTS Base Radio](https://agentprime.io/advisories/CVE-2023-23771.md)
  `CVE-2023-23771` · CVE record: Motorola MBTS Base Radio · CVSS 8.4 High · Not analysed yet · Published 29 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded password in Motorola MBTS Site Controller](https://agentprime.io/advisories/CVE-2023-23770.md)
  `CVE-2023-23770` · CVE record: Motorola MBTS Site Controller · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2023 · Tags: Hard-coded credentials
- [SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2](https://agentprime.io/advisories/CVE-2023-38026.md)
  `CVE-2023-38026` · CVE record: SPOTCAM CO., LTD. SpotCam FHD 2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2023 · Tags: Hard-coded credentials
- [SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1](https://agentprime.io/advisories/CVE-2023-38024.md)
  `CVE-2023-38024` · CVE record: SPOTCAM CO., LTD. SpotCam FHD 2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2023 · Tags: Hard-coded credentials
- [Netmaker has Hardcoded DNS Secret Key](https://agentprime.io/advisories/GHSA-8x8h-hcq8-jwwx.md)
  `GHSA-8x8h-hcq8-jwwx`, `CVE-2023-32077`, `GO-2023-2022` · Go `github.com/gravitl/netmaker`: affected `<0.17.1 || >=0.18.0, <0.18.6`, fixed in `0.17.1`, `0.18.6` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2023 · Tags: Hard-coded credentials
- [Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server](https://agentprime.io/advisories/CVE-2023-40707.md)
  `CVE-2023-40707` · CVE record: OPTO 22 SNAP PAC S1 · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Lenovo Notebook](https://agentprime.io/advisories/CVE-2022-3744.md)
  `CVE-2022-3744` · CVE record: Lenovo Notebook · CVSS 6.7 Medium · Not analysed yet · Published 23 Aug 2023 · Tags: Hard-coded credentials
- [Unsalted passwords in fobybus/social-media-skeleton](https://agentprime.io/advisories/CVE-2023-40173.md)
  `CVE-2023-40173` · CVE record: fobybus social-media-skeleton · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2023 · Tags: Hard-coded credentials
- [Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials](https://agentprime.io/advisories/GHSA-wwww-xvm2-62w7.md)
  `GHSA-wwww-xvm2-62w7`, `CVE-2023-40345` · Maven `org.jenkins-ci.plugins:delphix`: affected `<3.0.3`, fixed in `3.0.3` · CVSS 4.3 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: Hard-coded credentials
- [Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin vulnerable to exposure of system-scoped credentials](https://agentprime.io/advisories/GHSA-97mg-9jhf-r7rm.md)
  `GHSA-97mg-9jhf-r7rm`, `CVE-2023-40347` · Maven `org.jenkins-ci.plugins:maven-artifact-choicelistprovider`: affected `<=1.14`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: Hard-coded credentials
- [NPort IAW5000A-I/O Series Hardcoded Credential Vulnerability](https://agentprime.io/advisories/CVE-2023-4204.md)
  `CVE-2023-4204` · CVE record: Moxa NPort IAW5000A-I/O Series · CVSS 5.4 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: Hard-coded credentials
- [Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux](https://agentprime.io/advisories/CVE-2023-4327.md)
  `CVE-2023-4327` · CVE record: Broadcom LSI Storage Authority (LSA) · No CVSS score · Not analysed yet · Published 15 Aug 2023 · Tags: Hard-coded credentials
- [Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux](https://agentprime.io/advisories/CVE-2023-4328.md)
  `CVE-2023-4328` · CVE record: Broadcom LSI Storage Authority (LSA) · No CVSS score · Not analysed yet · Published 15 Aug 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Google Android](https://agentprime.io/advisories/CVE-2023-20965.md)
  `CVE-2023-20965` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Dataprobe iBoot PDU](https://agentprime.io/advisories/CVE-2023-3264.md)
  `CVE-2023-3264` · CVE record: Dataprobe iBoot PDU · CVSS 6.7 Medium · Not analysed yet · Published 14 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Dataprobe iBoot PDU](https://agentprime.io/advisories/CVE-2023-3262.md)
  `CVE-2023-3262` · CVE record: Dataprobe iBoot PDU · CVSS 6.7 Medium · Not analysed yet · Published 14 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Intel(R) Unison(TM) software](https://agentprime.io/advisories/CVE-2022-44612.md)
  `CVE-2022-44612` · CVE record: Intel(R) Unison(TM) software · CVSS 5.5 Medium · Not analysed yet · Published 11 Aug 2023 · Tags: Hard-coded credentials
- [Hard-coded Cryptographic Key in Kunduz - Homework Helper App](https://agentprime.io/advisories/CVE-2023-3632.md)
  `CVE-2023-3632` · CVE record: Sifir Bes Education and Informatics Kunduz - Homework Helper App · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2023 · Tags: Hard-coded credentials
- [PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels](https://agentprime.io/advisories/CVE-2023-37857.md)
  `CVE-2023-37857` · CVE record: PHOENIX CONTACT WP 6070-WVPS and 4 more · CVSS 3.8 Low · Not analysed yet · Published 9 Aug 2023 · Tags: Hard-coded credentials
- [BIG-IP FIPS HSM password vulnerability CVE-2023-3470](https://agentprime.io/advisories/CVE-2023-3470.md)
  `CVE-2023-3470` · CVE record: F5 BIG-IP · CVSS 6.0 Medium · Not analysed yet · Published 2 Aug 2023 · Tags: Hard-coded credentials
- [JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-37215.md)
  `CVE-2023-37215` · CVE record: JBL soundbar multibeam · CVSS 6.2 Medium · Not analysed yet · Published 30 Jul 2023 · Tags: Hard-coded credentials
- [Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-32227.md)
  `CVE-2023-32227` · CVE record: Synel SYnergy Fingerprint Terminals · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Google Chrome](https://agentprime.io/advisories/CVE-2022-4926.md)
  `CVE-2022-4926` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2023 · Tags: Hard-coded credentials
- [Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2023-3947.md)
  `CVE-2023-3947` · CVE record: j_3rk Video Conferencing with Zoom · CVSS 3.7 Low · Not analysed yet · Published 26 Jul 2023 · Tags: Hard-coded credentials
- [Hard-coded System User Credentials in Folio Data Export Spring module](https://agentprime.io/advisories/GHSA-m8v7-469p-5x89.md)
  `GHSA-m8v7-469p-5x89`, `CVE-2024-23685` · Maven `org.folio:mod-remote-storage`: affected `>=2.0.0, <2.0.3 || <1.7.2`, fixed in `2.0.3`, `1.7.2` · CVSS 5.3 Medium · Not analysed yet · Published 25 Jul 2023 · Tags: Hard-coded credentials
- [Hard-coded System User Credentials in Folio Data Export Spring module](https://agentprime.io/advisories/GHSA-vf78-3q9f-92g3.md)
  `GHSA-vf78-3q9f-92g3`, `CVE-2024-23687` · Maven `org.folio:mod-data-export-spring`: affected `>=2.0.0, <2.0.2 || <1.5.4`, fixed in `2.0.2`, `1.5.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jul 2023 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDIzLTA3LTI1VDEzOjUzOjQyLjAwMDAwMFoiLCJHSFNBLXZmNzgtM3E5Zi05MmczIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDIzLTEwLTI1VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy00MzkwNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDIzLTEwLTI1VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy00MzkwNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.